What is the CVSS score of CVE-2026-16623?

CVE-2026-16623 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Create Block Theme are affected by CVE-2026-16623?

Create Block Theme WordPress plugin versions before 2.10.0 contain a PHP code injection vulnerability that enables multisite subsite administrators to execute arbitrary server-side code through…. A patch is available.

Is there a public PoC exploit available for CVE-2026-16623?

Yes, a public proof-of-concept exploit is available for CVE-2026-16623. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16623?

Within 24 hours, conduct an inventory of all WordPress multisite installations and identify which run Create Block Theme plugin versions prior to 2.10.0. Within 7 days, deploy Create Block Theme version 2.10.0 or later to all affected instances, prioritizing production environments, and verify pattern file generation functions correctly post-update. Within 30 days, audit patch deployment completion across all systems and implement role-based restrictions limiting pattern creation capabilities to trusted administrators only.

Create Block Theme CVE-2026-16623

EUVD-2026-52579 HIGH

Code Injection (CWE-94)

2026-08-04 WPScan

GHSA-6wqp-7cwm-r4gv

PHP WordPress RCE Code Injection Create Block Theme Unknown

8.0

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Network-initiated via web interface (AV:N); WordPress multisite prerequisite raises complexity (AC:H); subsite administrator account required (PR:H); PHP execution escapes plugin scope to server (S:C) with full C/I/A impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:34 vuln.today

Patch available

Aug 04, 2026 - 07:01 EUVD

CVE Published

Aug 04, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 06:00 cve.org

HIGH 8.0

DescriptionCVE.org

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.

AnalysisAI

PHP code injection in the Create Block Theme WordPress plugin (before 2.10.0) enables a multisite subsite administrator to execute arbitrary server-side code by exploiting insufficient output escaping when the plugin writes user-supplied text into generated PHP pattern files. The vulnerability leverages a capability boundary mismatch unique to WordPress multisite: subsite admins hold the capability gating pattern file generation but are denied the capability normally required for PHP file editing, creating an unintended privilege escalation path to full remote code execution. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile), indicating exploitation is currently targeted rather than widespread.

Technical ContextAI

The Create Block Theme plugin (CPE: cpe:2.3:a:unknown:create_block_theme:*:*:*:*:*:*:*:*) is a WordPress.org-published tool enabling users to generate and manage block-based themes. The root cause is CWE-94 (Improper Control of Generation of Code): the plugin constructs PHP pattern files by concatenating user-supplied text directly into PHP source without adequate escaping or neutralization. In WordPress multisite, the capability system is intentionally split - the file_edit capability (normally required to write PHP) is disabled for subsite administrators, while the plugin's own pattern-generation capability is not similarly restricted. This asymmetry means a subsite admin can trigger the vulnerable code path and write attacker-controlled PHP into a file that the web server will subsequently interpret and execute. The Scope:Changed metric in the CVSS vector reflects that impact escapes the plugin's own security domain to the underlying PHP runtime.

RemediationAI

The primary remediation is to upgrade the Create Block Theme plugin to version 2.10.0 or later, which introduces correct escaping of user-supplied text before it is written into generated PHP pattern files; this patch is confirmed available from the vendor per the WPScan advisory at https://wpscan.com/vulnerability/19c7fdaa-5e75-481d-884c-68fdb2fb8f8d/. If an immediate upgrade is operationally infeasible, the most targeted compensating control is to revoke the specific capability that gates the pattern file generation action from all subsite administrator roles - this eliminates the attack vector while keeping the plugin installed, at the cost of disabling that feature for subsite admins. A secondary compensating control is to audit and reduce the set of users holding subsite administrator roles, retaining only fully trusted individuals. WAF-based controls are unlikely to be effective because the payload is written during a legitimate-looking authenticated action rather than a distinctly anomalous request. PHP file execution restrictions (e.g., disable_functions on generated theme directories) could limit impact but not the file write itself.